Privacy Map

Middle East. National jurisdiction.

Saudi Arabia SA

Primary authority: SDAIA
Part I

Domestic law

Comprehensive data protection2

  • PDPL Implementing RegulationsImplementing Regulation of the Personal Data Protection LawIn force
    In force from     Detailed rules operationalising the PDPL: lawful bases including legitimate interest, consent conditions, rights handling timelines, breach notification procedure, DPIAs, and DPO appointment criteria.
    Synopsis

    Detailed rules operationalising the PDPL: lawful bases including legitimate interest, consent conditions, rights handling timelines, breach notification procedure, DPIAs, and DPO appointment criteria.

    Key themes
    • consent
    • legitimate interest
    • DSAR timelines
    • breach notification
    • DPIA
    • DPO
    • records
    Unique features

    DPO mandatory for public entities doing large-scale processing, controllers whose core activity is systematic monitoring, or core processing of sensitive data; DPO details filed via the national platform.

    SaaS relevance

    Sets the concrete operational duties (notification, records, DPIAs) a SaaS processing Saudi data must build in.

    Extraterritorial
    Yes
    Breach notification
    SDAIA within 72h
    DPO
    Conditional
    Cross-border transfers
    See Transfer Regulation
    Maximum penalty
    As PDPL
    Key dates
    • Adopted
    • In force
    • Supplemented in 2024 by SDAIA rules on DPO appointment, Controller Register and guidelines
    Text
    Authority
    SDAIA
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact issuance date of the Implementing Regulation not re-verified; any 2024 amendment not confirmed.

    Full record for PDPL Implementing Regulations
    Partly verifiedMedium confidence. Exact issuance date of the Implementing Regulation not re-verified; any 2024 amendment not confirmed.
  • KSA PDPLPersonal Data Protection Law (Royal Decree No. M/19 of 9/2/1443H, as amended by Royal Decree No. M/148 of 5/9/1444H)In force
    In force from     Saudi Arabia's comprehensive data protection law, covering processing in the Kingdom and processing of residents' data from abroad, with lawful bases, rights, DPO, registration, breach notification and tight transfer rules. SDAIA is actively enforcing it.
    Synopsis

    Saudi Arabia's comprehensive data protection law, covering processing in the Kingdom and processing of residents' data from abroad, with lawful bases, rights, DPO, registration, breach notification and tight transfer rules. SDAIA is actively enforcing it.

    Key themes
    • lawful bases
    • data subject rights
    • registration
    • DPO
    • breach notification
    • transfers
    • sensitive data
    • marketing
    Unique features

    Controllers generally must register on the National Data Governance Platform; criminal penalties for intentional disclosure of sensitive data; courts may double fines for repeat offences. Sector regulators (SAMA, CST) retain parallel rules.

    SaaS relevance

    Applies to non-Saudi entities processing data of individuals residing in KSA, so foreign SaaS serving Saudi customers is in scope.

    Extraterritorial
    Yes
    Breach notification
    SDAIA within 72h; data subjects without undue delay where harm likely
    DPO
    Conditional
    Cross-border transfers
    Adequate countries (SDAIA list) or appropriate safeguards (SCCs, binding common rules, accreditation) with risk assessment; limited derogations
    Maximum penalty
    SAR 5m (doubling for repeat); SAR 3m and/or 2 years' prison for sensitive-data disclosure
    Key dates
    • Adopted
    • In force
    • Amended 27 Mar 2023 (M/148); in force 14 Sept 2023; one-year grace, enforceable from 14 Sept 2024
    Text
    Authority
    Saudi Data & AI Authority (SDAIA) / National Data Management Office
    Sources consulted
    Verification

    High confidence.

    Official SDAIA PDF could not be fetched (blocked); URL from known location.

    Full record for KSA PDPL

Cybersecurity4

  • DCCNCA Data Cybersecurity Controls (DCC)In force
    In force from     Controls for protecting data across its lifecycle at covered entities, scaled by data classification.
    Synopsis

    Controls for protecting data across its lifecycle at covered entities, scaled by data classification.

    Key themes
    • data classification
    • encryption
    • data lifecycle
    • DLP
    Unique features

    Builds on ECC with classification-specific data security controls.

    SaaS relevance

    Applies via contract to SaaS processing classified data for Saudi government/CNI.

    Extraterritorial
    Limited
    Key dates
    • Adopted
    • In force
    Text
    Authority
    National Cybersecurity Authority (NCA)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. No verification notes recorded.

    Full record for DCC
    Partly verifiedMedium confidence. No verification notes recorded.
  • CCCNCA Cloud Cybersecurity Controls (CCC)In force
    In force from     Extends the ECC with controls specific to cloud service providers and cloud service tenants serving government and CNI organisations.
    Synopsis

    Extends the ECC with controls specific to cloud service providers and cloud service tenants serving government and CNI organisations.

    Key themes
    • cloud security
    • CSP obligations
    • tenant obligations
    • data location
    Unique features

    Separate control sets for CSPs and CSTs; data classification drives where data may be hosted.

    SaaS relevance

    Cloud SaaS providers serving Saudi government/CNI must comply and may need NCA assessment.

    Extraterritorial
    Limited
    Cross-border transfers
    In-Kingdom hosting for higher classifications
    Key dates
    • Adopted
    • In force
    • CCC-1:2020; updated edition reported 2024
    Text
    Authority
    National Cybersecurity Authority (NCA)
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. Not verified this session beyond NCA site structure.

    Full record for CCC
    Partly verifiedLow confidence. Not verified this session beyond NCA site structure.
  • ECCNCA Essential Cybersecurity Controls (ECC)In force
    In force from     Baseline cybersecurity controls mandatory for government bodies, their companies and private operators of critical national infrastructure, covering governance, defence, resilience and third-party/cloud security.
    Synopsis

    Baseline cybersecurity controls mandatory for government bodies, their companies and private operators of critical national infrastructure, covering governance, defence, resilience and third-party/cloud security.

    Key themes
    • cybersecurity governance
    • third-party risk
    • cloud
    • incident management
    • data protection
    Unique features

    Requires that hosting and storage of the organisation's data be within the Kingdom where cloud services are used.

    SaaS relevance

    SaaS suppliers to Saudi government or CNI entities are flowed down ECC controls, including in-Kingdom hosting.

    Extraterritorial
    Limited
    Cross-border transfers
    In-Kingdom hosting expected for covered entities' data
    Key dates
    • Adopted
    • In force
    • ECC-1:2018; revised edition ECC-2:2024
    Text
    Authority
    National Cybersecurity Authority (NCA)
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. NCA pages loaded without readable control details; version numbers from prior knowledge.

    Full record for ECC
    Partly verifiedLow confidence. NCA pages loaded without readable control details; version numbers from prior knowledge.
  • Anti-Cyber Crime LawAnti-Cyber Crime Law (Royal Decree No. M/17 of 8/3/1428H)In force
    In force from     Criminalises unauthorised access, interception, defamation and invasion of privacy via IT devices, and unlawful access to bank or credit data.
    Synopsis

    Criminalises unauthorised access, interception, defamation and invasion of privacy via IT devices, and unlawful access to bank or credit data.

    Key themes
    • unauthorised access
    • interception
    • privacy invasion
    • financial data
    Unique features

    Invasion of privacy through camera-equipped phones or similar devices is a specific offence.

    SaaS relevance

    Brief: criminal backstop for security breaches and misuse of Saudi user data.

    Extraterritorial
    No
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Imprisonment up to 10 years and fines up to SAR 5m (most serious offences)
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Public Prosecution; Communications, Space & Technology Commission
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. Decree number/date and penalty range from prior knowledge; not freshly verified (official BOE site unreachable). [Link: Bureau of Experts official English translation hosted by MCIT; laws.boe.gov.sa entry not verified]

    Full record for Anti-Cyber Crime Law
    Partly verifiedLow confidence. Decree number/date and penalty range from prior knowledge; not freshly verified (official BOE site unreachable). [Link: Bureau of Experts official English translation hosted by MCIT; laws.boe.gov.sa entry not verified]

Data localisation / cross-border2

  • KSA Transfer RegulationRegulation on Personal Data Transfer outside the KingdomIn force
    In force from     Sets when personal data may leave Saudi Arabia: to jurisdictions assessed as adequate, under appropriate safeguards, or for listed purposes, provided national security and vital interests are not prejudiced.
    Synopsis

    Sets when personal data may leave Saudi Arabia: to jurisdictions assessed as adequate, under appropriate safeguards, or for listed purposes, provided national security and vital interests are not prejudiced.

    Key themes
    • adequacy
    • SCCs
    • binding common rules
    • accreditation certificates
    • transfer risk assessment
    Unique features

    Saudi SCCs (C2P, C2C, P2C, P2P) must be used unmodified; using a safeguard relieves the data-minimisation-for-transfer limit but triggers a risk assessment, as do continuous or large-scale sensitive-data transfers. SDAIA can suspend transfers to particular places.

    SaaS relevance

    Offshore-hosted SaaS must adopt the Saudi SCCs or another safeguard and complete transfer risk assessments.

    Extraterritorial
    Yes
    Cross-border transfers
    Adequacy list / Saudi SCCs / binding common rules / accreditation; risk assessment; SDAIA may suspend
    Maximum penalty
    As PDPL
    Key dates
    • Adopted
    • In force
    • Amended version issued by SDAIA 1 Sept 2024 together with Standard Contractual Clauses (4 modules)
    Text
    Authority
    SDAIA
    Sources consulted
    Verification

    High confidence.

    Full record for KSA Transfer Regulation
  • CCRFCST Cloud Computing Regulatory FrameworkIn force
    In force from     Regulates cloud service providers serving Saudi customers, including registration, customer data protection, breach reporting to CST and data location rules tied to data classification.
    Synopsis

    Regulates cloud service providers serving Saudi customers, including registration, customer data protection, breach reporting to CST and data location rules tied to data classification.

    Key themes
    • cloud registration
    • customer data
    • breach reporting
    • localisation
    • data classification
    Unique features

    Higher-classification customer content must remain in the Kingdom; CSPs must notify CST of security incidents.

    SaaS relevance

    SaaS offered to Saudi customers may count as a cloud service requiring CST registration and compliance.

    Extraterritorial
    Yes
    Breach notification
    CST (cloud incidents)
    Cross-border transfers
    Classification-based localisation
    Key dates
    • Adopted
    • In force
    • Issued by CITC (now CST); later revisions
    Text
    Authority
    Communications, Space & Technology Commission (CST)
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. Current version/date of CCRF not verified (CST pages not readable).

    Full record for CCRF
    Partly verifiedLow confidence. Current version/date of CCRF not verified (CST pages not readable).
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 5 instruments from 1 bodies.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.